chore(deps): update dependency undici to v8.9.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
undici (source)	8.5.0 → 8.9.0

---

Release Notes

nodejs/undici (undici)

v8.9.0

Compare Source

What's Changed

• fix(decompress): preserve response trailers by @​Ram-blip in #​5572
• build(deps-dev): bump ws from 8.21.0 to 8.21.1 by @​dependabot[bot] in #​5576
• fix: validate coerced header values for CRLF by @​mcollina in #​5579
• fix: handle frozen globalThis in setGlobalDispatcher by @​mhayk in #​5574
• Ignore auto-generated .npmrc on Windows by @​tsctx in #​5583

New Contributors

• @​mhayk made their first contribution in #​5574

Full Changelog: nodejs/undici@v8.8.0...v8.9.0

v8.8.0

Compare Source

What's Changed

• fetch: use ReadableStreamTee for cloning streams by @​KhafraDev in #​5517
• fix(benchmarks): adjust got after v15 upgrade by @​slagiewka in #​5526
• feat(mock): support asynchronous reply options callbacks by @​Develop-KIM in #​5534
• docs: clarify proxy threat model by @​mcollina in #​5530
• docs: clarify MockAgent pool usage by @​vibhor-aggr in #​5542
• docs: clarify parser timeout precision by @​vibhor-aggr in #​5543
• fix: handle flat alternating header arrays in cache normalizeHeaders by @​mcollina in #​5536
• chore(benchmarks): require(esm) on ESM-only packages by @​slagiewka in #​5527
• fix: run idle socket validation off setImmediate instead of setTimeout by @​carlotestor in #​5499
• docs: add custom interceptor example by @​vibhor-aggr in #​5548
• fix(h1): ignore type of service errors by @​mcollina in #​5547
• fix(fetch): convert null init in Response.json by @​Ram-blip in #​5540
• fix(redirect): remove body headers after POST-to-GET by @​Ram-blip in #​5551
• build(deps-dev): bump fast-check from 4.8.0 to 4.9.0 by @​dependabot[bot] in #​5556
• fix(h2): allow stream-bodied requests to multiplex on a busy session by @​GiHoon1123 in #​5538
• fix(h2): destroy aborted stream synchronously instead of via setImmediate by @​staylor in #​5559
• fix(decompress): skip HEAD responses by @​Ram-blip in #​5564
• ci: build undici with node.js v26 by @​shivarm in #​5237
• docs: clarify top-level request option url fields by @​vibhor-aggr in #​5545
• test: add unexpected disconnect guards to http2 tests by @​Develop-KIM in #​5533
• fix: track origins by client map key in Agent teardown by @​emmayusufu in #​5537
• fix: enforce must-revalidate and proxy-revalidate over max-stale and stale-if-error by @​jeswr in #​5511
• fix(retry): handle Retry-After zero delay by @​Ram-blip in #​5519
• fix: honor stale-if-error on connection errors during revalidation by @​jeswr in #​5513
• fix: store revalidation-only responses so etag revalidation can engage by @​jeswr in #​5515
• fix(h2): prevent uncaughtException from onHttp2SocketError accessing undefined kClient by @​mcollina in #​5546
• fix(h2): complete request stream on 'end' instead of waiting for 'close' by @​staylor in #​5560
• fix: invalidate Location and Content-Location URIs on unsafe methods by @​jeswr in #​5514
• test: deflake invalid websocket close status test by @​mcollina in #​5550
• refactor: replace tspl with node:test t.plan in connect-timeout tests by @​mcollina in #​5518
• fix(h2): release completed requests from queue by @​staylor in #​5569

New Contributors

• @​Develop-KIM made their first contribution in #​5534
• @​carlotestor made their first contribution in #​5499
• @​GiHoon1123 made their first contribution in #​5538
• @​emmayusufu made their first contribution in #​5537

Full Changelog: nodejs/undici@v8.7.0...v8.8.0

v8.7.0

Compare Source

What's Changed

• test: guard balanced-pool error port lookup by @​mcollina in #​5463
• perf: optimize http/2 request hot path by @​mcollina in #​5483
• fix: do not reject open-ended Range values in simpleRangeHeaderValue by @​spokodev in #​5490
• fix(eventsource): set use-URL-credentials flag by @​Ram-blip in #​5489
• test: deflake connect-timeout watchdog by @​mcollina in #​5197
• docs: correct npm script name and JSON syntax in examples by @​lenoxfernando in #​5496
• fix: reject non-ascii octets in validateCookiePath by @​spokodev in #​5452
• fix(readable): ignore late consume chunks by @​marko1olo in #​5375
• fix(h2): destroy the stream on abort instead of relying on close() by @​staylor in #​5462
• fix: ignore an unparseable Set-Cookie Expires attribute by @​spokodev in #​5488
• docs: add reproduction guide and update bug report template by @​mcollina in #​5451
• fix(h2): guard onResponse against a 'response' event delivered after completion by @​staylor in #​5440
• fix(h2): requeue request on GOAWAY'd session instead of crashing by @​staylor in #​5453
• fix: add static buildDispatch method to RedirectHandler type definition by @​matthieusieben in #​5442
• fix: auto-detect HTTP proxy tunneling by @​mcollina in #​5116

New Contributors

• @​spokodev made their first contribution in #​5490
• @​lenoxfernando made their first contribution in #​5496
• @​staylor made their first contribution in #​5462

Full Changelog: nodejs/undici@v8.6.0...v8.7.0

v8.6.0

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	undici@​8.9.0

View full report

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/node-modules/urllib@846

commit: 352dabb

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.28%. Comparing base (81b8a57) to head (352dabb).

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #846      +/-   ##
==========================================
+ Coverage   94.24%   94.28%   +0.04%     
==========================================
  Files          10       10              
  Lines         747      753       +6     
  Branches      235      235              
==========================================
+ Hits          704      710       +6     
  Misses         40       40              
  Partials        3        3              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.